Autoscaling Controller  ·  View 35 of 37  ·  6 · Assurance

RBAC and Change Control

Four roles, one change path, and the two things that need a second pair of eyes.

Editable source SVG draw.io All views
Roles Viewer read everything Policy Author propose versions Operator override, pause Administrator bounds, ceilings Change path Proposed Change with justification Approval Gate role dependent Extra scrutiny Second Approver ceiling or max Mandatory Expiry overrides only Effect Versioned Config effective from Still Inside Bounds no exception Evidence Audit Record actor, before, after 13 Months tamper evident 4 h default always Who May Change What Person or role Application we own Decision point Security / platform Data store synchronous An operator can pin a target but cannot raise its maximum. Raising a maximum needs an administrator and a second approver, and is recorded either way. v 1.0 · owner Data & AI Global Practice · date 2026-09

Decisions

  • Viewer, policy author, operator, administrator — and an operator can pin a target but cannot raise its maximum.
  • Second approver required for fleet-wide ceilings and for any target's max bound.
  • Every bound, override and degraded-mode choice is declared in the target's configuration and versioned with it.

The invariant

  • No role, and no combination of roles acting inside the controller, can put a target outside its declared [min, max].
  • Changing that bound is a configuration change with its own approval path, not an operation.

Evidence

  • Tamper-evident audit log carrying actor, target, before/after value and justification, retained 13 months.
◀  Identity Separation All views What It Does When It Cannot See  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 37 views · Azure and open source35-rbac-and-change-control